CVE-2026-59294

6.5 mediumEPSS 0.4%

Medium (6.5) in vmware spring ai. EPSS 0.4% chance of exploitation in the next 30 days.

ResourceCacheService.getCacheName() builds the on-disk filename by appending the URI fragment verbatim, without stripping path separators or .. sequences, and passes the result to new File(resourceParentFolder, newFileName) before writing the downloaded bytes there. Spring AI 2.0.0 Spring AI 1.1.0 - 1.1.8 Spring AI 1.0.9 and earlier

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

EPSS: 0.4% chance of exploitation in the next 30 days; higher than 29% of CVEs (scores of 2026-10-31)
CWE: CWE-22
Published: 2026-08-27
Modified: 2026-08-31
Record from: the NVD, synced 2026-10-19

Affected

vmware:spring_ai

References

https://spring.io/security/cve-2026-59294

Check your stack JSON